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1.0 


INTRODUCTION 


A current spacecraft hardware program at the Johns Hopkins AppLied 
Physics Laboratory requires an 1100 ampere-hour, 250 pound battery. This 
requirement can only be satisfied by a lithium chemistry battery. Several 
lithium chemistry systems were investigated with several manufacturers. A 
lithium thionyl chloride (Li/SOC^) F-size cell was selected. 

To assess the safety hazard associated with a battery composed of 
eight (8) modules each containing 72 F-sized cells, a fault tree analysis was 
required by the program. Previous experience with lithium chemistry batteries 
in the ALDOT (Air Launched Deep Ocean Transponder) and SARSAT ground 
transmitter (Search And Rescue Satellite) programs enabled us to carry out 
such an analysis efficiently. Much of the initial safety hazard assessment 
for a single lithium chemistry cell was summarized in an internal APL report 
available for government agency distribution only: "ALDOT Systems Safety 

Analysis and the Li/S02 Battery, 11 by 0. M. Uy and R. H. Maurer, APL Report SOR 
84084, August 1984. 


This current report presents the results of the safety fault tree 
analysis on the eight module, 576 F cell Li/SOC^ battery on the spacecraft 
and in the integration and test environment prior to launch on the ground. 

2.0 ELECTROCHEMISTRY REQUIREMENTS 


The battery requirement of the satellite is for a total capacity of 
1100 ampere-hours at a nominal 30 volts at 21°C and for a battery weight of 
less than 250 lbs. Figures 1-3 show the electrical and mechanical 
configuration of the battery. This translates to a specific energy density of 
at least 132 watt-hr/lb. A previous vendor survey for a battery requiring 
only 750 ampere-hours resulted in proposals which would have utilized 
Li/S0Cl2, Li/SO^, Li/CF^ and Zn/AgO cells, with only Li/SOC^ complying with 
the energy density requirement. When the battery capacity requirement was 
subsequently increased from 750 to 1100 ampere-hours, the cells considered 
were the Li/SOC^ and Li/SOgClg. Lithium sulfuryl chloride was quickly 
abandoned however, because it is not as well developed as Li/SOC^* Thus the 
electrochemical cells chosen in this program were the F-sized Li/SOC^ cells. 

3.0 QUALITY ASSURANCE CONSIDERATIONS 


In the fault tree analysis discussed later in this paper, it is shown 
that manufacturing defects such as internal mechanical shorts between anode 
and cathode or low cell capacities due to improper fill or failure of 
hermeticity and current leakage due to lithium diffusion through the ceramic 
insulator can lead to a decrease in the reliability of the battery and an 
increase in risk with respect to safety. It was therefore decided that a 
rigorous quality assurance procedure must be implemented with the cell 
manufacturer, with proper controls for acceptance and qualification of cell 
lots. We have chosen to incorporate the quality assurance documents from 
NASA, 9 the U.S. Array^ and Navy^, and negotiated with the cell vendor in 
order to come up with specific quality assurance procedures for the 
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procurement of the battery, the flow-charts of which are shown in Figures 
4-6. Even though these QA procedures are tailored to this program and this 
vendor, APL will be procuring lithium battery systems with similar 
specifications in the future. 

4.0 SAFETY CONSIDERATIONS 

Because of the high reliability and safety requirements of the 
program, the cells, as well as the electrical components used in the assembly 
of the battery, are either space or military high reliability parts. For 
example, the thermal fuses are 100% X-rayed and lot tested for thermal 
performance. There are three thermal fuses per string so that every cell in 
the battery is adjacent to a thermal fuse. Two blocking diodes are used in 
series in order to preclude charging of a cell string in the event of a single 
diode failure. The cells, modules and battery are subjected to random 
vibration and thermal environments in order to screen out workmanship defects 
such as weak solder or welding interconnections. Considerable attention is 
paid to insure that the cells used in each string and module are manufactured 
uniformly with respect to processes and materials. Finally, the sample cells 
and batteries will be subjected to overdischarge, high-rate discharge, short- 
circuit, heat-tape, capacity, vibration and thermal vacuum testing before the 
flight and spare batteries will be accepted for shipment to APL. 

5.0 DEVELOPMENT OF FAULT TREE ANALYSIS 


The safety fault tree for the battery module is shown in Figures 7 
and 8. It has been developed applying the principles of safety fault tree 
analysis published in the IEEE Transactions on Reliability , the Journal of 
the System Safety Society^, and the Reliability Design Handbook • 

In the fault tree the Top Event whose occurrence is potentially 
catastrophic leading to mission failure is the explosion or structural 
fragmentation of a battery module originated by the explosion of one or more 
cells in the battery pack. A single cell explosion may lead to the Top Event 
if the module container fails to operate as designed and relieve the 
overpressure condition; thus, a primary explosion may cause the Top Event. In 
addition, a single cell explosion may cause the Top Event to occur by creating 
overpressure and overtemperature conditions inside the battery pack which 
damage or make other neighboring batteries unstable leading to a second 
sympathetic explosion of such speed (less than 100 milliseconds) and force 
that not enough venting can occur soon enough even with the module vents 
functioning as designed (see Figures 7 and 8). 

Basic events which either initiate the Top Event or enable it to 
occur are shown as ovals in the fault tree diagrams. AND gates in the tree 
are marked with A; OR gates with 0. Intermediate and Top Events are shown as 
rectangles. Due to the size of the fault tree, it has been split into two 
figures with the intermediate event, single cell explodes, common to each main 
branch in Figures 7 and 8 and shown in detail in Figure 9. Figures 7 and 8 
show that a single cell exploding and the failure of the module vents or a 
single cell exploding and the module operating nominally but with a 
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sympathetic secondary explosion occurring can lead to the Top Event. The 
assumption that has been made in the analysis is that if a single cell 
explodes, a secondary explosion of greater magnitude due to a multiple battery 
explosion will follow with some non-zero probability — here very 
conservatively taken as a probability equal to 1. 

The basic events causing a single cell to explode are shown in Figure 
9. Note that we have assumed that it is much more likely for a single cell to 
explode in the primary explosion scenario than for several to explode 
simultaneously. We would expect that a two or three cell primary explosion 
would occur with a frequency approximately equal to the square or cube 
respectively of the single cell primary explosion probability. This low 
probability multiple battery primary explosion is to be distinguished from a 
multiple battery sympathetic secondary explosion which seems to be of a fairly 
high probability once the unstable conditions created by the primary explosion 
of a single cell are in existence. 

Figure 9 is the part of the fault tree showing the possible causes of 
single cell explosion. The branch of the tree under battery charging leads 
directly to an overpressure condition so quickly that the individual cell vent 
cannot prevent explosion from occurring. This charging condition can occur if 
a cell in a given string of cells, which is parallel with other strings of 
cells in the module, has low capacity relative to the other cells in the 
string and if the two diodes protecting the string both either fail shorted or 
have been installed backwards in any combination of these two fault 
conditions • 

In order to make the various conditions necessary for the single cell 
explosion to occur more understandable we will list the ten minimum cut sets 
(Table 1) for all critical system states leading to the event "Single Cell 
Explodes" in Figure 9. The first set will be for the battery charging 
condition explained above. 

The ten sets of basic events have been determined from literature 
search and discussion with experts involved with the manufacture and use of 
lithium batteries for both military and commercial applications. In order to 
determine the relative importance of the various branches in the fault tree, 
estimates must be made of the probability of occurrence of all basic events 
which are then propagated through the fault tree by addition at OR gates and 
multiplication at AND gates. These estimates and the rationale for their use 
are the subject of the next section. 

After the original fault tree to estimate the module failure in the 
spacecraft had been developed, we also estimated the safety hazard incurred if 
modules were stored for one month on the ground during integration (Figure 
8). The presence of an SO 2 detector lowers the risk of undetected cell or 
module venting and the consequent release of toxic gases in the vicinity of 
integration personnel to about one chance in 10,000. 
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Table 1 


A. 

or 

B. 

C. 

or 

or 

D. 

or 

E. 


Minimum Cut Sets for CriticaL System States 
for the Event "Single Cell Explodes 11 


Cell Charging 

1. Cell Low and Diodes Installed Backwards 

2. Cell Low and Diodes Fail Shorted 

3. Cell Low and one Diode Fails and the other is installed 
backwards 

Overt emnerature 


1. High Ambient Temperature and Cell Vent Struck or Slow 

Internal Short (leading to Overtemperature) 

1. Seal Failure leading to shorting condition and Cell Vent 
Stuck or Slow 

2* Single Cell Shorted by external wire or conductive debris 
and Cell Vent Stuck or Slow 

3. Manufacturing Defects creating internal short and Cell Vent 
Stuck or Slow 

High Rate Discharge (leading to Over temperature) 

1. Multi-cell Short due to external wire or debris and Thermal 
Fuse shorted and Thermal Switch shorted and Cell Vent 
Stuck or Slow 

2. One or more cells shorted to ground and Fuse shorted and 
Thermal Fuse shorted and Thermal Switch shorted and Cell 
Vent Stuck or Slow 

Forced Overdischarge (the rate may not be very high) 

1* Cell within string with low capacity and Other cells in 
string with normal capacity and Thermal Fuse shorted and 
Thermal Switch shorted and Cell Vent Stuck or Slow 
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6.0 


PROBABILITIES OF FAULT TREE BASIC EVENTS 


The probabilities of the fault tree basic events for a singLe 
spacecraft mission are shown in Table 2 together with comments about the 
rationale behind the use of the numbers. Table 3 shows the probability of an 
individual battery having a capacity which is 25% discharged. 

It is readily seen that some of these basic event probabilities are 
time dependent and that some (usually related to conditions existing at the 
time of manufacture or to human factors) are independent of time. When the 
probability of module failure in storage is estimated, all time dependent 
basic event probabilities are multiplied by the number of hours in a month 
(720) rather than the 168 hour value assumed for the duration of the 
spacecraft mission. 


The probability of failure for the diodes, gas sensors, relief valves 
(vents) and fuses are calculated with models and data from MIL Handbook 217D 
for the electronic parts® and the Nonelectronic Parts Reliability Data" both 
compiled by the Reliability Analysis Center of the Rome Air Development Center 
at Griffiss Air Force Base in New York. Base failure rates are taken from 
life test data and are usually given at a 60% confidence level from testing 
involving 10^ component hours or more. These base failure rates are 
subsequently derated for several factors among which are 


a) the environment that the part will be used in; e.g.. Airborne, 
Uninhabited Transport 

b) the quality level of the part, e.g. commercial or military, and 
the level of screening that has been applied in the part 
selection 

c) in some cases, the current rating of the device 

d) the application of the device, e.g. analog circuit with less 
than 500 mA operating current. 

e) a stress factor usually calculated as a ratio of the applied 
voltage or power to the rated voltage or power of the device 

f) in some cases a construction factor, e.g. hermetically sealed 
or matallurgically bonded. 

These numbers are generally given as failures per million hours of operation 
which is easily transformed into a rate of failures per hour for a single 
unit. 
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Table 2 


Basic Event Probabilities for Single Module 


Basic Event: 


Probability of Failure 


Comment 


Fault Tree Number 


1. 1N5614 diode 2.73xl0“ 10 per hour 

fails short 


Diode install- 10 4 per diode 
ed incorrect- 
ly 

Fuse or therm- 3.89x10 ^ 

al fuse fails 

short 


4. 


5. 


Battery cell 
shorted to 
ground 


10~ 4 per cell 


Battery cells 10~ 4 per cell 
shorted to- 
gether 


Single cell 
internal 
manufacturing 
defects 

Single cell 
short due to 
conductive 
fragments 


7x10 


-5 


10~ 4 per cell 


,3 


2.10x10 


-15 


-8 


-5 


MIL Handbook 217D 
number times 168 hours 
flight time squared for 
two diodes per voltage 
string 

Aerojet General Human 10 

Error ® Rates Table; 
square of probability 
for single string 

Non-electronic parts^ 6.54x10 
reliability data times 
168 hours flight time 
times one fuse 

-3 

Experience with welded 7.2x10 
wire board shorts times 
72 cells 

Experience with welded 2.88x10 
wire boards times 288 
possible pairs to short 
together 

Non-electronic parts^ 5.04x10 ^ 
reliability data -times 
72 cells 


Experience with welded 
wire boards times 72 
cells 


7.2x10 


-3 
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Table 2 (Continued) 


Basic Event Probabilities for Single Module 


Basic Event 

8. Internal short 
due to seal 
failure 


9. High ambient 
temperature 

10. Individual 
cell vent 
stuck or slow 

11. Explosion for 
unexplained 
reasons 

12. Module vents 
clog 


13. SO 2 sensor 
on ground 
malfunctions 


14. Thermal 

switch fails 
to open 


Probability of Failure 
1.83x10"^ per hour 

lxlO -6 

lxlO -5 

lxlO -6 

5xl0 - ^ per hour 


3.5xl0~ 6 
10 -4 per hour 


Comment 

SANDIA data^ on new 
cell seal times 168 
hours flight times 
times 72 cells 

Temperature greater than 
100°C highly unlikely 
in spacecraft or storage 

Non-electronic parts 
data 9 on relief 
valve 

An estimate 


Non-electronic parts 
data 9 on failure of 
mechanical couplings or 
springs times 168 hours 
flight time squared for 
two vents 

Non-electronic parts 9 
data on sensors in gen- 
eral times 720 hours 
per month on ground 

. Q 

Non-electronic parts^ 
data on thermal switches 
times 168 hours flight 
time 


Fault Tree Number 
2.21xl0~ 2 


lxlO -6 

lxlO -5 

lxlO" 6 

7.06xl0“ 7 


2.52xl0" 3 /month 


1.68xl0~ 2 
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Table 3 


Probability of Low Cell Capacity 
(25% Discharged) 

Coefficient of Standardized Probability of Fault Tree Number 

Variation, o/x Normal Variate, Z 25% Discharge Cell Charging Forced Over-Discharge 


0.09 


2.78 


2.7xl0~ 3 0.194 


0.151 


1 ) 


Calculate: 


MEAN-LOWER LIMIT 
STANDARD DEVIATION 


X - LL 


a 



1-.75 



.25 



2) Probability found assuming a normal distribution 

3) 72 cells in voltage strings for battery charging branch 

4) 56 cells in position for forced overdischarge branch of fault tree 

5) Probability of other cells in string having nominal capacity (for forced 
overdischarge) 

Prob = p 8 = (1-q) 8 = 0.979 

where q is the probability of a single cell being 25% discharged 
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When the mode of failure is also significant, data on the 
distribution of failure modes has also been used. In assessing mission 
reliability, whether a part fails electrically open or short may make no 
difference since a subsystem will often fail to function in either case. 
However, in assessing safety hazards it is often the case that only one 
failure mode presents a threat. In the case of the battery module, diodes and 
fuses must fail in a shorted condition for the various branches of the fault 
tree to be able to initiate a catastrophe. For example, 90% of the time fuses 
fail short or perform as if short because they are slow to open or exceed the 
designed current rating. 

As shown in Table 2 the values used for probability of failure are 
multiplied by the number of hours, assumed to be 168 for the spacecraft 
mission, when they are time dependent and the number of parts when more than 
one can be independently susceptible to failure at the same time. For the 
storage case a separate table was not created but the numbers inserted into 
the fault tree (see Figure 9) have been multiplied by 720 hours representing 
one month of storage/integration time. Figures 10-13 show the numbers used in 
the respective spacecraft and storage fault trees for basic events from Table 
2 and for intermediate and top events as calculated by either multiplying (AND 
gates) or adding (OR gates) as one proceeds up the branches of the fault tree 
from the bottom. 

Several more comments are necessary about the basic event 
probabilities listed in Table 2. ‘Mechanical basic event probabilities were 
assigned from data on devices which were similar in function and operation. 

The number on the individual cell vent being stuck or slow comes from data on 
pressure relief valves but is not considered to be time dependent because of 
the method of manufacture. 

Probabilities for shorting to occur come from the authors 1 experience 
with the fabrication of welded wire boards for space hardware and soldered 
test boards for large designed reliability test programs. 

Human factors probabilities are the most variable and the "softest 11 
numbers in the fault trees. Values presented have been arrived at using the 
Aerojet General Human Error Rates Table* 5 for various common tasks plus 
discussions with a safety expert at the Naval Safety Center in Norfolk, 
Virginia 12 . 


Table 3 shows the probability of having an individual cell of low 
capacity (ampere-hours) given the coefficient of variation (the ratio of the 
standard deviation to the mean of the capacity for a set of samples) of the 
cells as manufactured. Selection of the value 0.09 is the result of 
discussions with the manufacturer. We defined battery low as being a 25% 
discharged condition even though testing has most often concentrated on 50% 
discharged cells. Thus, if the coefficient of variation of the lithiura- 
thionyl choloride cells is 0.09, a 25% discharge state is 2.78 standard 
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_3 

deviations from the mean with a probability of occurrence of 2.7 x 10 • This 

last number comes from any table of probabilities for standardized normal 
variates assuming a normal distribution for cell capacities. 

The probability of an individual cell being 25% discharged (CELL LOW 
in the fault trees) is then multiplied by the number of cells in the module 
battery pack.. Thus, "Fault Tree Numbers" presented in Table 3 are entered as 
CELL LOW in calculating the frequency of occurrence of the Top Event of the 
fault tree. In addition, (see Cell Charging branch) the probability for one 
diode being incorrectly installed is 10 ; for two to be simultaneously 

incorrectly installed is 10 • Actually, if one diode were inserted 

backwards, the second one might also have a high probability of being inserted 
in a like manner; however, a polarity check has been specified in the 
fabrication process. The probability of this polarity check failing has been 
judged to be the same order of magnitude as installing a diode backwards. 

Thus, we maintain the 10~ 8 value. 

Some logic implicit in the fault trees will now be explained. Once 
we have determined the probability for anyone of 72 independent cells having 
low capacity or being shorted to ground or being internally shorted, we must 
be careful not to overestimate the probability of protective devices such as 
diodes, fuses or cell vents failing at the same time to enable the cell 

failure to cause cell explosion. That is, any of 72 cells can have low 

capacity or be internally shorted which is why the single cell probabilities 
are multiplied by 72 in some cases in Table 1. However, once a single battery 
cell has low capacity or is internally shorted, it is only the vent for that 
cell or the diodes for that cell f s string or the fuse associated with that 
cell that can simultaneously fail enabling single cell explosion to occur. 

The failure of other vents, diodes, fuses, etc. not associated with the cell 

in question would not enable the top event of single cell explosion to 

occur. Therefore, the probabilities of failure for protective devices such as 
diodes, fuses, cell vents, etc. are not multiplied by the total number of such 
components in the battery module (see Table 2). 


Table 3 also contains a column showing values for the Forced 
Overdischarge branch of the fault trees. For this phenomena cells at the end 
of strings are not included because voltage reversal cannot occur unless both 
cell terminals are connected to neighboring cells in a series circuit. Only 
the seven interior cells in the voltage strings - a total of 56 cells - can 
experience this failure mode. Together with a single cell having low 
capacity, the remaining cells in the same string must have nominal ^ 

capacities. The probability for nominal cell capacity in this case is p = 
(1-q) 8 where q is the probability of one interior cell having low capacity. 


In Table 2 the probability of failure from an Internal Short due to 
cell Seal Failure is given as 1.83 x 10~ 6 per hour, which, when multiplied by 
the 168 hour flight time in the spacecraft and 72 cells in the battery pack 
yields 2.21 x 1G~ 2 for the spacecraft fault tree (see Figure 12). For the 
storage fault tree (see Figure 13), however, we do not multiply by the 720 
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hours in a month. The shorting due to seal failure is a self-limiting process 
in that as a crack in the seal becomes larger with time, there is less 
capacity in the cell to supply the greater current that can now flow. The 
Seal Failure Internal Short is a very slow physical mechanism and 
consideration of both individual cell capacity and the level of current 
necessary for heating lead us to conclude that such an internal short must 
take place over a period of roughly 100-200 hours to generate heat fast enough 
to create an OVERTEMPERATURE condition. For the Storage Fault Tree the Seal 
Failure basic event probability has also been multiplied by 168 instead of 720 
hours . 


7.0 USE OF THE FAULT TREE 


Two points must be emphasized at the outset of this discussion: A) 

we have assumed that Failure of the battery module initiated by the explosion 
of a single cell is equivalent to damage to the spacecraft; B) the main 
usefulness of the fault trees and the purpose for which they are most valuable 
is determining the relative importance of the various branches of the fault 
tree and the sensitivity of the Top Event occurrence frequency to significant 
changes in any of the basic event probabilities. The fault tree will show 
which factors are most important to be improved or closely controlled in order 
to make the Top Event frequency as low as possible within the limits of 
practicality. 

The "hardness” or absolute accuracy in many of the probabilities 
presented in Figures 10-13 can be argued at some length. Thus, instead of 
taking a given Top Event probability as a gospel value it is better to state 
that if we relax stringent limits on quality control and don't do a good job 
in the battery module design, our Top Event hazard probability may be as great 
as 10 - ^ for the mission; while, conversely, if we do the best possible job of 
quality control on components, and cells and do a good job on the module 
design, our Top Event hazard probability may be as low as 10 per module, 
essentially that for explosion for unexplained reasons. 


Likewise, the probability for an undetected Single Cell Venting 
(Figure 11) during one month’s Storage/Integration is reduced from 3.43 x 10 
to 8.63 x 10“ 5 per module by the use of an on-site S0 2 detector during 
integration. The probability of a single cell venting is calculated from 
Figure 13 with the basic event Cell Vent Stuck or Slow probability set equal 
to one (the cell vents as it is supposed to; no explosion occurs, but gases 
are released from the battery module). 


-2 


8.0 CONCLUSIONS 

The analysis has shown that with the right combination of blocking 
diodes, electrical fuses, thermal fuses, thermal switches, cell balance, cell 
vents and battery module vents the probability of a single cell or a 72-cell 
module exploding can be reduced to 10 , essentially the probability due to 

explosion for unexplained reasons. This one chance in a million value for the 
module is quite conservative since we have assumed (see Figure 10) that if a 
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single ceLl explodes, then one or more additional cells will also explode in a 
sympathetic secondary reaction even though the module vents 
operatenominally . This certainty of an uncontrollable secondary explosion 
seems to us to be the only reasonable assumption based on the present dearth 
of data for battery modules of the present design and for cells of Li/SOC^ 
chemistry. 


For one month of integration an<£ test of the spacecraft on the ground 
the probability of module failure is 10 0 (Figure 11) as stated above. Of 
equal importance we have considered the possibility of a cell venting (the 
cell vent operates correctly in Figure 13 and the 10 probability of the cell 
vent being stuck or slow is replaced by 0.99999) and releasing toxic gases 
that may injure personnel. The probability of a cell venting has been 
calculated as 3.43 x 10 ^ in Figure 13. We can reduce the probability of 
personnel exposure by the use of a sulfur dioxide monitor in line with the 
module vent manifold. An audible alarm will be triggered whenever the 
concentration of SO 2 exceeds 1 ppm in the manifold. The left side of Figure 
11 shows that this reduces the probability of an undetected toxic gas release 
to 8.63 x 1(T 5 per battery module or about 7 x 10 for the complete 
spacecraft battery. 
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Figure 2. Module configuration. 
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Figure 4. Cell fabrication and test flow. 
































Figure 5. Module fabrication and test flow. 
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Figure 6. Battery fabrication and test flow. 
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Figure 7. Battery module safety fault tree for spacecraft. 
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Figure 8. Battery module safety fault tree for ground integration. 
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Figure 10. Battery module safety fault tree for spacecraft. 
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Figure 11. Battery module safety fault trees for ground integration. 
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Figure 12. LiSOCl 2 single cell safety fault tree for spacecraft. 
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Figure 13. LiSOCl 2 single cell safety fault tree for storage of 1 month. 
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